Privacy Policy

Last updated: March 2026

Dragon Metals (trading name of Bronze Bracken) is committed to protecting your personal data. This Privacy Policy explains how we collect, use and protect your information when you use our website at dragonmint.co.uk.

We are a sole trader business based in Wales, UK and act as the data controller for the purposes of UK GDPR.

1. What Data We Collect

When you place an order, we collect:

• Full name
• Email address
• Phone number (optional)
• Delivery address
• Order details and payment status

We do not collect or store payment card details. Card payments are processed by Stripe, who have their own privacy policy at stripe.com/gb/privacy. Cryptocurrency payments are processed by NOWPayments.

2. How We Use Your Data

We use your personal data to:

• Process and fulfil your order
• Send order confirmation and dispatch notification emails
• Generate shipping labels via Shippo / Royal Mail
• Respond to customer service enquiries
• Comply with our legal obligations

We do not use your data for marketing purposes unless you have explicitly opted in. We do not sell your data to third parties.

3. Legal Basis for Processing

We process your personal data on the basis of:

• Contract performance — to fulfil your order
• Legal obligation — to comply with UK tax and consumer law
• Legitimate interests — to prevent fraud and maintain business records

4. Who We Share Your Data With

We share your data only with trusted third parties necessary to fulfil your order:

• Stripe — payment processing (stripe.com)
• NOWPayments — cryptocurrency payment processing
• Shippo / Royal Mail — shipping label generation and delivery
• Resend — transactional email delivery
• Railway — secure hosting of our website and database

All third parties are required to handle your data in compliance with applicable data protection law.

5. Data Retention

We retain your order data for 7 years in accordance with HMRC requirements for business records. After this period, your data is securely deleted.

6. Your Rights

Under UK GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your data (subject to legal retention requirements)
• Restriction — ask us to limit how we process your data
• Portability — receive your data in a portable format
• Objection — object to processing based on legitimate interests

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days.

7. Cookies

Our website uses only essential cookies required for the checkout session to function. We do not use tracking, advertising or analytics cookies.

8. Security

We take appropriate technical measures to protect your data, including SSL encryption, secure hosting and access controls. However, no internet transmission is completely secure and we cannot guarantee absolute security.

9. Complaints

If you have concerns about how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date.

11. Contact

For any privacy-related enquiries, contact us at [email protected].